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Abstract 

This paper investigates an open problem introduced in ifT^ . Two or more mobile agents start from 
different nodes of a network and have to accomplish the task of gathering which consists in getting all 
together at the same node at the same time. An adversary chooses the initial nodes of the agents and 
assigns a different positive integer (called label) to each of them. Initially, each agent knows its label 
but does not know the labels of the other agents or their positions relative to its own. Agents move in 
synchronous rounds and can communicate with each other only when located at the same node. Up to / 
of the agents are Byzantine. A Byzantine agent can choose an arbitrary port when it moves, can convey 
arbitrary information to other agents and can change its label in every round, in particular by forging the 
label of another agent or by creating a completely new one. 

What is the minimum number A4 of good agents that guarantees deterministic gathering of all of 
them, with termination? 

We provide exact answers to this open problem by considering the case when the agents initially 
know the size of the network and the case when they do not. In the former case, we prove Ai = f + 1 
while in the latter, we prove Ai = f + 2. More precisely, for networks of known size, we design 
a deterministic algorithm gathering all good agents in any network provided that the number of good 
agents is at least / +1. For networks of unknown size, we also design a deterministic algorithm ensuring 
the gathering of all good agents in any network but provided that the number of good agents is at least 
/ + 2. Both of our algorithms are optimal in terms of required number of good agents, as each of them 
perfectly matches the respective lower bound on A4 shown in iflTll . which is of / + 1 when the size of 
the network is known and of / + 2 when it is unknown. 

Perhaps surprisingly, our results highlight an interesting feature when put in perspective with known 
results concerning a relaxed variant of this problem in which the Byzantine agents cannot change their 
initial labels. Indeed under this variant A4 = 1 for networks of known size and A4 = f + 2 for networks 
of unknown size. Following this perspective, it turns out that when the size of the network is known, the 
ability for the Byzantine agents to change their labels significantly impacts the value of Ai. However, 
the relevance for Ai of such an ability completely disappears in the most general case where the size of 
the network is unknown, as AI = / + 2 regardless of whether Byzantine agents can change their labels 
or not. 
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1 Introduction 


1.1 Context 

Gathering is one of the most fundamental tasks in the field of distributed and mobile systems in the sense 
that, the ability to gather is in fact a building block to achieve more complex cooperative works. Loosely 
speaking, the task of gathering consists in ensuring that a group of mobile entities, initially located in 
different places, ends up meeting at the same place at the same time. These mobile entities, hereinafter 
called agents, can vary considerably in nature ranging from human beings and robots to animals and software 
agents. The environment in which the agents are supposed to evolve can vary considerably as well: it may 
be a terrain, a network modeled as a graph, a three-dimensional space, etc. We can also consider that the 
sequences of instructions followed by the agents in order to ensure their gathering are either deterministic 
or randomized. 

In this paper, we consider the problem of gathering in a deterministic way in a network modeled as a graph. 
Thus, the agents initially start from different nodes of the graph and have to meet at the same node by 
applying deterministic rules. We assume that among the agents, some are Byzantine. A Byzantine agent is 
an agent subject to unpredictable and arbitrary faults. For instance such an agent may choose to never stop 
or to never move. It may also convey arbitrary information to the other agents, etc. The case of Byzantine 
fault is very interesting because it is the worst fault that can occur to agents. As a consequence, gathering in 
such a context is challenging. 

1.2 Model and problem 

The distributed system considered in this paper consists of a group of mobile agents that are initially placed 
by an adversary at arbitrary but distinct nodes of a network modeled as a finite, connected, undirected 
graph G = {V,E). We assume that |L| = re. In the sequel re is also called the size of the network. 
Two assumptions are made about the labelling of the two main components of the graph that are nodes and 
edges. The first assumption is that nodes are anonymous i.e., they do not have any kind of labels or identifiers 
allowing them to be distinguished from one another. The second assumption is that edges incident to a node 
V are locally ordered with a fixed port numbering ranging from 0 to deg{v) — 1 where deg{v) is the degree 
of V. Therefore, each edge has exactly two port numbers, one for each of both nodes it links. The port 
numbering is not supposed to be consistent: a given edge (re, v) € E may be the f-th edge of re but the j-th 
edge of V, where i / j. These two assumptions are not fortuitous. The primary motivation of the first one 
is that if each node could be identified by a label, gathering would become quite easy to solve as it would 
be tantamount to explore the graph (via e.g. a breadth-first search) and then meet in the node having the 
smallest label. While the first assumption is made so as to avoid making the problem trivial, the second 
assumption is made in order to avoid making the problem impossible to solve. Indeed, in the absence of 
a way allowing an agent to distinguish locally the edges incident to a node, gathering could be proven as 
impossible to solve deterministically in view of the fact that some agents could be precluded from traversing 
some edges and visit some parts of the graph. 

An adversary chooses the starting nodes of the agents. The starting nodes are chosen so that there are not 
two agents sharing initially the same node. At the beginning, an agent has a little knowledge about its 


1 


surroundings: it does not know either the graph topology, or the number of other agents, or the positions of 
the others relative to its own. Still regarding agents’ knowledge, we will study two scenarios: one in which 
the agents initially know the parameter n and one in which the agents do not initially know this parameter 
or even any upper bound on it. 

Time is discretized into an infinite sequence of rounds. In each round, every agent, which has been previ¬ 
ously woken up (this notion is detailed in the next paragraph), is allowed to stay in place at its current node 
or to traverse an edge according to a deterministic algorithm. The algorithm is the same for all agents: only 
the input, whose nature is specified further in the subsection, varies among agents. 

Before being woken up, an agent is said to be dormant. A dormant agent may be woken up only in two 
different ways: either by the adversary that wakes some of the agents at possibly different rounds, or as soon 
as another agent enters the starting node of the dormant agent. We assume that the adversary wakes up at 
least one agent. 

When an agent is woken up in a round r, it is told the degree of its stalling node. As mentioned above, 
in each round r' > r, the executed algorithm can ask the agent to stay idle or to traverse an edge. In the 
latter case, this takes the following form: the algorithm ask the agent, located at node u, to traverse the edge 
having port number i, where 0 < f < deg{u) — 1. Let us denote by (u, v) ^ E this traversed edge. In round 
r' + 1, the agents enters node v. it then learns the degree deg{v) as well as the local port number j of {u, v) 
at node v (recall that in general i ^ j). An agent cannot leave any kind of tokens or markers at the nodes it 
visits or the edges it traverses. 

In the beginning, the adversary also assigns a different positive integer (called label) to each agent. Each 
agent knows its label but does not know the labels of the other agents. When several agents are at the same 
node in the same round, they see the labels of the other agents and can exchange all the information they 
currently have. This exchange is done in a “shouting” mode in one round: all the exchanged information 
becomes common knowledge for agents that are currently at the node. On the other hand when two agents 
are not at the same node in the same round they cannot see or talk to each other: in particular, two agents 
traversing simultaneously the same edge but in opposite directions, and thus crossing each other on the same 
edge, do not notice this fact. In every round, the input of the algorithm executed by an agent a is made up of 
the label of agent a and the up-to-date memory of what agent a has seen and learnt since its waking up. Note 
that in the absence of a way of distinguishing the agents, the gathering problem would have no deterministic 
solution in some graphs. This is especially the case in a ring in which at each node the edge going clockwise 
has port number 0 and the edge going anti-clockwise has port 1: if all agents are woken up in the same 
round and start from different nodes, they will always have the same input and will always follow the same 
deterministic rules leading to a situation where the agents will always be at distinct nodes no matter what 
they do. 

Within the team, it is assumed that up to / of the agents are Byzantine. The parameter / is known to all 
agents. A Byzantine agent has a high capacity of nuisance: it can choose an arbitrary port when it moves, 
can convey arbitrary information to other agents and can change its label in every round, in particular by 
forging the label of another agent or by creating a completely new one. All the agents that are not Byzantine 
are called good. We consider the task of /-Byzantine gathering which is stated as follows. The adversary 
wakes up at least one good agent and all good agents must eventually be in the same node in the same round. 
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simultaneously declare termination and stop, provided that there are at most / Byzantine agents. Regarding 
this task, it is worth mentioning that we cannot require the Byzantine agents to cooperate as they may always 
refuse to be with some agents. Thus, gathering all good agents with termination is the strongest requirement 
we can make in such a context. 

What is the minimum number M of good agents that guarantees /-Byzantine gathering? 

At first glance, the question might appear as not being really interesting since, after all, the good agents 
might always be able to gather in some node, regardless of the number of Byzantine agents evolving in the 
graph. However, this is not the case as pointed out by the study that introduced this question in |[T4l . More 
specifically, when this size is initially known to the agents, the authors of this study described a deterministic 
algorithm gathering all good agents in any network provided that there are at 2/ + 1 of them, and gave a 
lower bound of / + 1 on Ad by showing that if the number of good agents is not larger than /, then there are 
some graphs in which the good agents are not able to gather deterministically with termination. When the 
size of the network is unknown, they did a similar thing but with different bounds: they gave an algorithm 
working for a team including at least 4/ + 2 good agents, and showed a lower bound of / + 2 on Ad. 
However, the question of what the tight bounds are was left as an open problem. 

1.3 Our results 

In this paper, we solve this open problem by proving that the lower bounds of / + 1 and / + 2 on Ad, shown 
in HI, are actually also upper bounds respectively when the size of the network is known and when it is 
unknown. More precisely, we design deterministic algorithms allowing to gather all good agents provided 
that the number of good agents is at least / + 1 when the size of the network is initially known to agents, 
and at least / + 2 when this size is initially unknown. 

Perhaps surprisingly, our results highlight an interesting feature when put in perspective with results con¬ 
cerning a relaxed variant of this problem (also introduced in Ifldll ') in which the Byzantine agents cannot 
change their initial labels. Indeed under this variant Ad = 1 for networks of known size and A4 = / -|- 2 
for networks of unknown siz^ Following this perspective, it turns out that when the size of the network 
is known, the ability for the Byzantine agents to change their labels significantly impacts the value of Ad. 
However, the relevance for Ad of such an ability completely disappears in the most general case where the 
size of the network is unknown, as A4 = / -|- 2 regardless of whether Byzantine agents can change their 
labels or not. 

1.4 Related works 

Historically, the first mention of the gathering problem appeared in |[^ under the appellation of rendezvous 
problem. Rendezvous is the term which is usually used when the studied task of gathering is restricted to 
a team of exactly two agents. From this publication until now, the problem has been extensively studied so 
that there is henceforth a huge literature about this subject. This is mainly due to the fact that there is a lot 

*The proof that both of these values are enough, under their respective assumptions regarding the knowledge of the network 
size, relies on algorithms using a mechanism of blacklists that are, informally speaking, lists of labels corresponding to agents 
having exhibited an “inconsistent” behavior. Of course, in the context of our paper, we cannot use such blacklists as the Byzantine 
agents can change their labels and in particular steal the identities of good agents. 
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of alternatives for the combinations we can make when approaching the problem, e.g., by playing on the 
environment in which the agents are supposed to evolve, the way of applying the sequences of instructions 
(i.e., deterministic or randomized) or the ability to leave some traces in the visited locations, etc. Naturally, in 
this paper we are more interested in the research works that are related to deterministic gathering in networks 
modeled as graphs. This is why we will mostly dwell on this scenario in the rest of this subsection. However, 
for the curious reader wishing to consider the matter in greater depth, we invite him to consult |I71[Tl[T9l that 
address the problem in the plane via various scenarios, especially in a system affected by the occurrence of 
faults or inaccuracies for the last two references. Regarding randomized rendezvous, a good starting point 
is to go through ll^ISlI^. 

Concerning the context of this paper, the closest work to ours is obviously |[T4l . Nonetheless, in similar 
settings but without Byzantine agents, there are some papers that should be cited here. This is in particular 
the case of |[T3l in which the author presented a deterministic protocol for solving the rendezvous problem, 
which guarantees a meeting of the two involved agents after a number of rounds that is polynomial in the 
size n of the graph, the length I of the shorter of the two labels and the time interval r between their wake-up 
times. As an open problem, the authors ask whether it is possible to obtain a polynomial solution to this 
problem which would be independent of r. A positive answer to this question was given, independently 
of each other, in |[^ and f2^ . While these algorithms ensure rendezvous in polynomial time (i.e., a poly¬ 
nomial number of rounds), they also ensure it at polynomial cost since the cost of a rendezvous protocol 
is the number of edge traversals that are made by the agents until meeting and since each agent can make 
at most one edge traversal per round. However, it should be noted that despite the fact a polynomial time 
implies a polynomial cost, the reciprocal is not always true as the agents can have very long waiting periods 
sometimes interrupted by a movement. Thus these parameters of cost and time are not always linked to each 
other. This was highlighted in |[^ where the authors studied the tradeoffs between cost and time for the 
deterministic rendezvous problem. More recently, some efforts have been dedicated to analyse the impact 
on time complexity of rendezvous when in every round the agents are brought with some pieces of informa¬ 
tion by making a query to some device or some oracle, see, e.g., ifTTlI^ . Along with the works aiming at 
optimizing the parameters of time and/or cost of rendezvous, some other works have examined the amount 
of memory that is required to achieve deterministic rendezvous e.g., in ifT^fTTl for tree networks and in Q 
for general networks. 

All the aforementioned studies that are related to gathering in graphs take place in a synchronous scenario 
i.e., a scenario in which the agents traverse the edges in synchronous rounds. Some efforts have been also 
dedicated to the scenario in which the agents move asynchronously: the speed of agents may then vary and 
is controlled by the adversary. For more details about rendezvous under such a context, the reader is referred 
to ll2^ [TOl [151 [TSl for rendezvous in finite graphs and HUll for rendezvous in infinite grids. 

Aside from the gathering problem, our work is also in conjunction with the field of fault tolerance via the 
assumption of Byzantine faults to which some agents are subjected. First introduced in ll26l . a Byzantine 
fault is an arbitrary fault occurring in an unpredictable way during the execution of a protocol. Due to its 
arbitrary nature, such a fault is considered as the worst fault that can occur. Byzantine faults have been 
extensively studied for “classical” networks i.e., in which the entities are fixed nodes of the graph (cf., e.g., 
the book fTBi or the survey ||5l). To a lesser extend, the occurrence of Byzantine faults has been also studied 
in the context of mobile entities evolving in the plane, cf. jHHIJl. Prior to our work, gathering in arbitrary 
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graphs in presence of Byzantine agents was considered only in |[T4l . As mentioned in the previous section, 
it is proven in ifTdIl that the minimum number M of good agents that guarantees /-Byzantine gathering is 
precisely 1 for networks of known size and / + 2 for networks of unknown size, provided that the Byzantine 
agents cannot lie about their labels. The proof that both of these values are enough, under their respective 
assumptions regarding the knowledge of the network size, relies on algorithms using a mechanism of black¬ 
lists that are, informally speaking, lists of labels corresponding to agents having exhibited an “inconsistent” 
behavior. Of course, in the context of our paper, we cannot use such blacklists as the Byzantine agents can 
change their labels and in particular steal the identities of good agents. 

2 Preliminaries 

Throughout the paper, the number of nodes of a graph is called its size. In this section we present two 
procedures, that will be used as building blocks in our algorithms. The aim of both of them is graph 
exploration, i.e., visiting all nodes of the graph by a single agent. The first procedure, based on universal 
exploration sequences (UXS), is a corollary of the result of Reingold |[27l . Given any positive integer N, 
this procedure allows the agent to traverse all nodes of any graph of size at most N, starting from any node 
of this graph, using P{N) edge traversals, where P is some polynomial. After entering a node of degree 
d by some port p, the agent can compute the port q by which it has to exit; more precisely q = {p + Xi) 
mod d, where Xi is the corresponding term of the UXS of length P{N). 

The second procedure needs no assumption on the size of the network but it is performed by an agent 
using a fixed token placed at a node of the graph. It works in time polynomial in the size of the graph. (It 
is well known that a terminating exploration even of all anonymous rings of unknown size by a single agent 
without a token is impossible.) In our applications the roles of the token and of the exploring agent will be 
played by agents or by groups of agents. At the end of this second procedure, the agent has visited all nodes 
and determined a BPS tree of the underlying graph. 

We call the first procedure EXPLO{N) and the second procedure EST, for exploration with a stationary 
token. We denote by T{EXPLO{n)) the execution time of procedure EXPLO with parameter n (note 
that T{EXPLO{n)) = P{n) + 1). We denote by T{EST{N)) the maximum time of execution of the 
procedure EST in a graph of size at most N. 

3 Known graph size 

This section aims at proving the following theorem 

Theorem 3.1 Deterministic f-Byzantine gathering ofk good agents is possible in any graph of known size 
if and only ifk>f-\-l. 

As mentioned in Subsection 1 1.21 we know from ifM that: 

Theorem 3.2 (fll) Deterministic f-Byzantine gathering of k good agents is not possible in some graph of 
known size if k < f. 

Thus, to prove Theorem 13.11 it is enough to show the following theorem. 

Theorem 3.3 Deterministic f-Byzantine gathering ofk good agents is possible in any graph of known size 
ifk>f-k 1 . 
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Hence, the rest of this section is devoted to proving Theorem 13.31 To do so, we show a deterministic 
algorithm that gathers all good agents in an arbitrary network of known size, provided there are at least 
/ + 1 of them. 

Before presenting the algorithm, we first give the high level idea which is behind it. Let us assume an ideal 
situation in which each agent would have as input, besides its label and the network size n, a parameter 
p = {G*, L*) corresponding to the initial configuration of the agents in the graph such that: 

• G* represents the re-node graph with all port numbers, in which each node are assigned an identifier 
belonging to {1, • • • , re}. The node identifiers are pairwise distincf. Nofe that the representation G* 
contains more information than there is in the actual graph G as it also includes node identifiers which 
do nof exist in G. 

• L* = {{vi,li), {v 2 ,l 2 ), ■ ■ ■ , {vk,h)} where {vi,li) G L* iff there is a good agent having label li 
which is initially placed in G at the node corresponding to Vi in G*. Remark that fc>/ + l. 

Let us also assume that all the agents in the graph are woken up at the same time by the adversary. In such 
ideal situation, gathering all good agents can be easily achieved by ensuring that each agent moves towards 
the node v where the agent having the smallest label is located. Each agent can indeed do that by using 
the knowledge of p = {G*, L*) and its own label. Of course, all the good agents do not necessarily reach 
node V at the same time. However, once at node v, each agent can estimate the remaining time which is 
required to wait in order to be sure that all good agents are at node v: again this estimation can be computed 
using p = (G*, L*) and the fact that all agents are woken up in the same round. Unfortunately, the agents 
are not in such ideal situation. First, every agent is not necessarily woken up by the adversary, and for 
those that are woken by the adversary, this is not necessarily in the same round. Second, the agents do 
not have configuration p as input of the algorithm. In our algorithm we cope with the first constraint by 
requiring the first action to be a traversal of the entire graph (using procedure EXPLO{n)) which allows 
to wake up all encountered agents that are still dormant. In this way, the agents are “almost synchronized” 
as the delay between the starting times of any two agents is at most T{EXPLO{n))\ the waiting time 
periods can be adjusted regarding this maximum delay. The second constraint i.e., the non-knowledge of 
p, is more complicated to deal with. To handle the lack of information about p, agents make successive 
assumptions about it that are “tested” one by one. More precisely, let V be the recursively enumerable set 
of all the configurations pi = {G*,L*) such that G* is a connected re-node graph and \L*\ > f + 1. Let 
0 = {pi, p 2 , P 3 , ■ ■ ■) he. a. fixed enumeration of V (all good agents agree on this enumeration). Each agent 
proceeds in phases numbered 1, 2, 3, • • •. In each phase i, an agent supposes that p = Pi and, similarly as 
in the ideal situation, tries to go to the node which is supposed to correspond to node v, where v is the node 
where the agent having the smallest label is initially located (according to pi). For some reasons detailed 
in the algorithm (refer to the description of state setup), when pi ^ p some agents may be unable to 
make such a motion. As a consequence, these agents will consider that, rightly, pi / p. On the other hand, 
whether pi ^ pox not, some other good agents may reach a node for which they had no reason to think it is 
not V (and thus pi ^ p). The danger here is that when reaching the supposed node v these successful agents 
could see all the \L*\ labels of pi (with the possible “help” of some Byzantine agents). At this point, it may 
be tempting to consider that gathering is over but this could be wrong especially in the case where Pi ^ p 
and some good agents did not reach a supposed node v in phase i. To circumvent this problem, the idea is 
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to get the good agents thinking that pi = p\o fetch the (possible) others for which Pi ^ p via a traversal of 
the entire graph using procedure EXPLO{n) (refer to the description of state tower). To allow this, an 
agent for which Pi ^ p will wait a prescribed amount of rounds in order to leave enough time for possible 
good agents to fetch it (refer to the description of state wait-for-a-tower). For our purposes, it is 
important to prevent the agents from being fetched any old how by any group, especially those containing 
only Byzantine agents. Hence our algorithm is designed in such a way that within each phase at most one 
group, called a tower and made up of at least / + 1 agents, will be unambiguously recognized as such and 
be allowed to fetch the other agents via an entire traversal of the graph (this guarantee principally results 
from the rules that are prescribed in the description of state tower builder). When a tower has finished 
the execution of procedure EXPLO{n) in some phase i, our algorithm guarantees that all good agents are 
together and declare gathering is over at the same time (whether the assumed configuration pi corresponds 
to the real initial configuration or not). On the other hand, in every phase i, if a tower is not created or 
“vanishes” (because there at not at least / + 1 agents inside of it anymore) before the completion of its 
traversal, no good agent will declare that gathering is over in phase i. In the worst case, the good agents 
will have to wait until assuming a good hypothesis about the real initial configuration, in order to witness 
the creation of a tower which will proceed to an entire traversal of the network (and thus declare gathering 
is over). 

We now give a detailed description of the algorithm. 

Algorithm Byz-Known-Size with parameter n (know size of the graph) 

The algorithm is made up of two parts. The first part aims at ensuring that all agents are woken up before 
proceeding to the second part which is actually the heart of the algorithm. 

Part 1. As soon as an agent is woken up by the adversary or another agent, it starts proceeding to a traversal 
of the entire graph and wakes up all encountered agents that are still dormant. This is done using procedure 
EXPLO{n) where n is the size of the network which is initially known to all agents. Once the execution 
of EXPLO{n) is accomplished, the agent backtracks to its starting node by traversing all edges traversed 
in EXPLO{n) in the reverse order and the reverse direction. 

Part 2. In this part, the agent works in phases numbered 1, 2, 3, • • •. During the execution of each phase, 
the agent can be in one of the following five sfafes: setup, tower builder, tower, wait-f or-a-tower, 
failure. Below we describe fhe acfions of an agenf A in each of fhe sfafes as well as fhe fransifions be- 
fween fhese sfafes wifhin phase i. We assume fhaf in every round agenf A fells fhe ofhers (sharing fhe same 
node as agenf A) in which sfafe if is. In some sfafes, fhe agenf will be required fo fell more fhan jusf ifs 
currenf sfafe: we will menfion if in fhe descripfion of fhese sfafes. Moreover, in fhe description of every sfafe 
X, when we say “agenf A fransifs fo sfafe Y”, we exacfly mean agenf A remains in sfafe X until fhe end of 
fhe currenf round and is in sfafe Y in fhe following round. Thus, in each round of fhis part, agenf A is always 
exacfly in one sfafe. 

Af fhe beginning of phase i, agenf A enfers sfafe setup. 

State setup. 

Lef Pi be fhe i-fh configuration of enumeration 0 (refer fo above). If fhe label I of agenf A is nof in pi, fhen 
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it transits to state wait-for-a-tower. Otherwise, let X be the set of the shortest paths in pi leading 
from the node containing the agent having label I, to the node containing the smallest label of the supposed 
configuration. Each path belonging to X is represented as the corresponding sequence of port numbers. Let 
TT be the lexicographically smallest path in X (the lexicographic order can be defined using the total order 
on the port numbers). Agent A follows path vr in the real network. If , following path tt, agent A has to 
leave by a port number that does not exist in the node where it currently resides, then it transits to state 
wait-f or-a-tower. In the same way, it also transits to state wait-f or-a-tower if, following path 
TT, agent A enters at some point a node by a port number which is not the same as that of path vr. Once path 
vr is entirely followed by agent A, it transits to state tower builder. 

State tower builder. 

When in state tower builder, agent A can be in one of the following three substates: yellow, 
orange, red. In all of these substates the agent does not make any move: it stays at the same node 
denoted by v. At the beginning, agent A enters substate yellow. By misuse of language, in the rest of this 
paper we will sometimes say that an agent “is yellow” instead of “is in substate yellow”. We will also 
use the same kind of shortcut for the two other colors. In addition to its state, we also assume that in every 
round agent A tells the others in which substate it is. 

Substate yellow 

Let /c be the number of labels in configuration pi. Agent A waits T(£'XPLO(n))+ n rounds. If during this 
waiting period, there are at some point at least k orange agents at node v then agent A transits to substate 
red. Otherwise, if at the end of this waiting period there are not at least k agents residing at node v such 
that each of them is either yellow or orange, then agent A transits to state walt-f or-a-tower, else 
it transits to substate orange. 

Substate orange 

Agent A waits at most T{EXPLO{n)) + n rounds to see the occurrence of one of the following two 
events. The first event is that there are not at least k agents residing at node v such that each of them is either 
yellow or orange. The second event is that there are at least k orange agents residing at node v. Note 
that the two events cannot occur in the same round. If during this waiting period, the first (resp. second) 
event occurs, then agent A transits to state walt-f or-a-tower (resp. substate red). If at the end of the 
waiting period, none of these events has occurred, then agent A transits to substate walt-f or-a-tower. 

Substate red 

Agent A waits T{EXPLO{n)) + n rounds. If at each round of this waiting period there are at least k red 
agents at node v, then at the end of the waiting period, agent A transits to state tower. Otherwise, there is a 
round during the waiting period in which there are not at least k red agents at node v. agent A then transits 
to state walt-f or-a-tower as soon as it notices this fact. 

State tower. 

Agent A can enter state tower either from state tower builder or state walt-f or-a-tower. While 
in this state, agent A will execute all or part of procedure EXPLO{n). In both cases we assume that, in 


every round, agent A tells the others the edge traversal number of EXPLO{n) it has just made (in addition 
to its state). We call this number the index of the agent. Below, we distinguish and detail the two cases. 

When agent A enters state tower from state tower builder, it starts executing procedure EXPLO (n). 
In the first round, its index is 0. Just after making the j-th edge traversal of EXPLO{n), its index is j. 
Agent A carries out the execution of EXPLO{n) until its term, except if at some round of the execution the 
following condition is not satisfied, in which case agent A transits to state failure. Here is the condition: 
the node where agent A is currently located contains a group S of at least / + 1 agents in state tower 
having the same index as agent A. S includes agent A but every agent that is in the same node as agent A is 
not necessarily in S. If at some point this condition is satisfied and the index of agent A is equal to P{n), 
which is the total number of edge traversals in EXPLO{n) (refer to Section |2l), then agent A declares that 
gathering is over. 

When agent A enters state tower from state wait-for-a-tower, it has just made the s-th edge traversal 
of EXPLO[n) for some s (cf. state wait-for-a-tower) and thus, its index is s. Agent A executes 
the next edge traversals i.e., the s + 1-th, s + 2-th, • • •, and then its index is successively s -t- 1, s -|- 2, etc. 
Agent A canies out this execution until the end of procedure EXPLO{n), except if the same condition as 
above is not fulfilled at some round of the execution of the procedure, in which case agent A also transits to 
state failure. As in the first case, if at some point the node where agent A is cuirently located contains a 
group S of at least / -I- 1 agents in state tower having an index equal to P{n), then agent A declares that 
gathering is over. 

State wait-f or-a-tower. 

Agent A waits at most 5T{EXPLO{n)) -|-4n rounds to see the occurrence of the following event: the node 
where it is currently located contains a group of at least f + 1 agents in state tower having the same index 
t. If during this waiting period, agent A sees such an event, we distinguish two cases. If t < P{n), then it 
makes the t -I- 1-th edge traversal of procedure EXPLO{n) and transits to state tower. If t = P{n), then 
it declares that gathering is over. 

Otherwise, at the end of the waiting period, agent A has not seen such an event, and thus it transits to state 

failure. 

State failure. Agent A backtracks to the node where it was located at the beginning of phase i. To 
do this, agent A traverses in the reverse order and the reverse direction all edges it has traversed in phase i 
before entering state failure. Once at its starting node, agent A waits lQT{EXPLO{n)) + 9n—p rounds 
where p is the number of elapsed rounds between the beginning of phase i and the end of the backtrack it 
has just made. At the end of the waiting period, phase i is over. In the next round, agent A will start phase 
i + l. 

3.1 Proof of correctness 

The proof of correctness is made up of seven lemmas and two propositions. The validity of Algorithm 
Byz-Known-Size (and by extension Theorem 13.31 ) follows from Lemmas 13.61 and 13.71 However to prove 
both these lemmas, we first need to establish the following two propositions and to prove the following five 
lemmas. 
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Part 1 of Algorithm Byz-Known-Size consists in executing procedure EXPLO{n) and then traversing all 
edges traversed in EXPLO{n) in the reverse order and the reverse direction. In view of the fact that 
procedure EXPLO{n) allows an agent to visit all nodes of the graph, we know that the delay between the 
starting rounds of any two good agents is at most T{EXPLO{n)). Hence we get the following proposition. 

Proposition 3.1 Let A and B be two good agents. The delay between the starting rounds of agents A and 
B is at most T[EXPLO{n)). 

According to Part 1 of Algorithm Byz-Known-Size and the rules of state failure, we have the following 
proposition. 

Proposition 3.2 At the beginning of every phase it executes, a good agent is at the node where it was woken 
up. 

Lemma 3.1 Let Q(n) = WT{EXPLO{n)) + 9n. For every good agent A and every positive integer i, if 
at some point agent A starts executing the i-th phase of Algorithm Byz-Known-Size, then either it will spend 
exactly Q{n) rounds executing the i-th phase or it will declare that gathering is over after having spent at 
most Q{n) rounds in the i-th phase. 

Proof. Let A be an agent that starts executing the i-th phase of Algorithm Byz-Known-Size in round r and 
assume that agent A does not declare that gathering is over by round r + Q{n) — 1. To prove the lemma, 
it is then enough to prove that agent A starts executing the i -|- 1-th phase of Algorithm Byz-Known-Size in 
round r -\- Q{n). 

Let us first assume by contradiction that agent A declares gathering is over when executing the i-th phase 
of Algorithm Byz-Known-Size. In view of the fact that agent A does not declare that gathering is over by 
round r Q{n) — 1, we know that this declaration occurs in round r -|- Q{n) at the earliest. However, 
according to Algorithm Byz-Known-Size, and especially the maximum duration of each state within any 
given phase (in particular a good agent cannot spend more than n rounds in state setup of any given phase 
in view of Proposition 13.21) . agent A cannot spend more than 9T{EXPLO{n)) + 8n rounds in phase i 
without entering state failure. Hence agent A enters state failure of phase i before round r -f Q{n). 
But according to Algorithm Byz-Known-Size, once agent A is in state failure of phase i, it cannot reach 
the states tower and wait-f or-a-tower of phase i, which are the only two states wherein an agent 
can declare that gathering is over. We then get a contradiction with the fact that agent A declares gathering 
is over when executing the i-th phase of Algorithm Byz-Known-Size. 

As a consequence, we know that agent A does not declare gathering is over when executing the f-th phase 
of Algorithm Byz-Known-Size. According to the algorithm, it then ends up entering state failure of 
phase i after a finite number x of rounds which is upper bounded by 9T{EXPLO{n)) 8n as mentioned 
above. When entering state failure, agent A starts backtracking to the node v where it was located at 
the beginning of phase i. Since before switching to state failure of phase i, agent A follows a path 
made up of at most n — 1 edges and can proceed to at most one (possibly truncated) execution of procedure 
EXPLO{n), backtracking to v, in state failure of phase i, takes y < T{EXPLO{n)) -\- n rounds. 
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When the backtrack is done, agent A has spent p = x + y < 10T(EXPLO(n)) + 9n rounds in phase i 
and starts waiting 10T(EXPLO(n)) + 9n — p rounds. The end of the waiting period is reached in some 
round r' when agent A has spent exactly 10T(EXPLO(n)) + 9n rounds in phase i: according to Algorithm 
Byz-Known-Size, agent A starts executing phase i + 1 in round r' + 1, which proves the lemma. 

□ 

Before continuing, we need to introduce some slight additional notions in order to facilitate the presentation 
of other lemmas. For any positive integer i, we say that a good agent A tests configuration pi when it 
executes the i-th phase of Algorithm Byz-Known-Size. We also say that there is a tower Tj at node v in 
round t if, and only if, there are at least / -|- 1 agents, at node v in round t, which are in state tower and 
have index j. The members that make up Tj at node v in round t are then all the agents, which are at node 
V in round t, being in state tower and having index j. 

Remark 3.1 Since there are at least / -I- 1 agents in every tower, there is at least one good agent in every 
tower as there are at most f Byzantine agents in the network. 


Lemma 3.2 Let Tj be a tower located at node v in round t. There is at least one good agent in Tj which 
has been in state tower since round t — j. 

Proof. Assume by contradiction that there is no good agent in tower Tj which has been in state tower since 
round t—j. By definition of a tower, every good agent, which is in tower Tj, is in state tower and has index 
j in round t. Let A be a good agent in Tj. Note that agent A exists in view of Remark [TTI The last time 
agent A decided to transit to state tower before round t was necessarily from state wait-f or-a-tower. 
Indeed, if that was not the case, that would imply that the last round r < t when agent A decided to transit to 
state tower was from state tower builder. However, according to Algorithm Byz-Known-Size, agent 
A would have entered state tower with index 0 in round r -|- 1 and would have stayed in state tower until 
round t in which it has index j. Hence, r + 1 = t — j and agent A would have been in state tower since 
round t — j, which would be a contradiction with our starting assumption. 

Denote by s < f the last round when agent A enters state tower from state wait-f or-a-tower. 
Without loss of generality, let us assume, for each good agent in Tj, the last time s' < f it enters state 
tower is such that s < s' < t. According to Algorithm Byz-Known-Size, agent A is in state tower 
and has index j — (t — s) in round s. Moreover, in round s — 1 agent A decides to transit from state 
wait-f or-a-tower to state tower because it is at a node in which there are at least / + 1 agents in 
state tower having index j — {t — s) — 1: among them there is necessarily a good agent B as there are 
at most / Byzantine agents. Still according to Algorithm Byz-Known-Size, agents A and B make together 
the j — {t — s)-th edge traversal of EXPLO{n) and are in state tower with index j — {t — s) at the same 
node V in round s. In round s, there are at least f + 1 agents in state tower having index j — {t — s), 
otherwise that would imply either there is no tower located at node v in round t if t = s, or agent A is in 
state failure in round s -|- 1 if s < f: in the former case we would get a contradiction with the existence 
of tower Tj, and in the latter case we would get a contradiction with the definition of round s. Thus, if s < f 
then we know from Algorithm Byz-Known-Size that agents A and B make together the j — {t — s) + 1-th 
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edge traversal of EXPLO{n) and are in state tower with index j — (f — s) + 1 at the same node u in 
round s + 1. Following a similar reasoning to that used above, we can prove that there are at least / + 1 
agents in state tower having index j — (f — s) + 1 in round s + 1 at node u. So, if s + 1 < f, then we know 
from Algorithm Byz-Known-Size that agents A and B make together the j — {t — s) + 2-th edge traversal 
of EXPLO{n) and are in state tower with index j — {t — s) + 2 at the same node w in round s + 2. By 
induction, we can then prove that agents A and B are together in round t and that agent B belongs to Tj. 
However, in round t we know that agent B has been in state tower without interruption since at least round 
s — 1, which contradicts the fact that for each good agent in Tj the last time s' < tit enters state tower is 
such that s < s' < t. Hence the last time agent A transited to state tower before round t was neither from 
state wait-f or-a-tower nor from state tower builder. Since an agent can transit to state tower 
only from states wait-f or-a-tower or tower builder, we get a contradiction with the existence 
of A, and thus the lemma holds. □ 


Lemma 3.3 Let Abe a good agent that is either orange, or red or in state tower in round r. Let pi 
be the configuration tested by agent A in round r. All good agents, which do not declare gathering is over 
before round r, test pi in round r. 

Proof. Assume by contradiction there exists some round x (playing the role of round r in the statement of 
the lemma) such that the lemma does not hold. Without loss of generality, let us assume that x is the first 
round for which this lemma is false. 

Let H be a good agent that does not declare gathering is over before round x. 

Since agent A is either orange, or red or in state tower, in round x it has already finished part 1 of 
Algorithm Byz-Known-Size which consists in executing procedure EXPLO{n) and then traversing all 
edges traversed in EXPLO{n) in the reverse order and the reverse direction. In view of the fact that 
procedure EXPLO{n) allows an agent to visit all nodes of the graph, we know that agent B is not dormant 
in round x. 

Since agent B is not dormant in round x, to prove the lemma it is then enough to show that in round x it 
cannot be in part 1 of Algorithm Byz-Known-Size or test a configuration pj such that j < i or j > i. 

First assume by contradiction that agent B tests a configuration pj in round x such that j < i. Let us consider 
the case when agent A is orange in round x. Since agents A and B do not declare that gathering is over 
before round x, Lemma lLTl implies that in round x agent B has spent at most 2T{EXPLO{n))+j*Q{n) < 
2T{EXPLO{n)) + {i — l)Q{n) rounds since its wake-up. In view of Lemma [LT] and the period of 
T{EXPLO{n)) + n rounds which is necessary to wait in substate yellow to enter substate orange, 
when in round x agent A has spent at least 2T{EXPLO{n)) -|- (f — 1) * Q{n) + T{EXPLO{n)) + n 
rounds since its wake up. This implies that the delay between the starting rounds of agents A and B is 
greater than T{EXPLO{n)), which contradicts Proposition 13.II 

Let us consider the case when agent A is in state tower in round x. If agent A is red or in state tower 
in round x — 1, then according to Algorithm Byz-Known-Size it also tests configuration pi in round x — 1. 
However, since agent B tests pj in round x, according to Algorithm Byz-Known-Size it is either in part 1 
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of the algorithm, or also in phase j, or in phase j — 1 (only if j > 1). Hence if agent A is red or in state 
tower in round x — 1, then the lemma does not hold in round x — l and we get a contradiction with the fact 
that X is the first round for which this lemma is false. So, assume that agent A is neither red nor in state 
tower in round x — l. According to Algorithm Byz-Known-Size it is in state wait-f or-a-tower in 
round x — l. The reason for which it decides to transit to state tower in round x — 1 is due to the fact that 
there is a tower Ts in round x — 1 for some index s. As for round x, agent A also tests configuration pi in 
round x — 1 in view of Algorithm Byz-Known-Size. By assumption, the lemma holds in round x — l, and 
thus there is at least a good agent in state tower belonging to Ts in round x — l which tests configuration 
Pi. However, as mentioned above agent B cannot test configuration pi in round x — l. Asa consequence, 
the lemma does not hold in round x — l and we get a contradiction with fact that x is the first round for 
which this lemma is false. 

Let us now consider the case when agent A is red in round x. According to Algorithm Byz-Known-Size it 
also tests configuration pi in round x — l and there is a good agent C (not necessarily different from A) that 
is orange or red. Since the lemma holds in round x — l, agent C also tests pi in round x — l. From this 
point, using as above the fact that agent B does not test configuration pi in round x — 1, we know that the 
lemma does not hold in round x — l and we obtain the same contradiction. 

Hence agent B does not test a configuration pj in round x such that j < i. In a similar way, we can prove 
that agent A cannot be in part 1 of Algorithm Byz-Known-Size in round x. So, it remains to prove that agent 
A does not test a configuration pj in round x such that j > i. 

Assume by contradiction agent B tests a configuration pj in round x such that j > i. According to Algorithm 
Byz-Known-Size and Proposition 13.21 if agent A is orange (resp. red) in round x, we know that it has 
spent at most 2T{EXPLO{n)) + 3n (resp. 3T{EXPLO{n)) + An) rounds in phase i when in round x. 
Thus, in round x, if agent A is orange (resp. red), agent A has spent at most 2T{EXPLO{n)) + {i — 
1) * Q(n) + 3T(EXPLO(n)) + An rounds since its wake up in view of Lemma [3Tl However according 
to Lemma im in round x agent B has spent at least 2T{EXPLO{n)) + i* Q{n) = 2T{EXPLO{n)) + 
(i — 1) * Q{n) + {l^T{EXPLO{n)) + 9n) rounds since its wake up. Hence, the delay between the starting 
rounds of agents A and B is greater than T{EXPLO{n)), which contradicts Proposition l3.ll Thus agent A 
is necessary in state tower of phase i in round x. According to Algorithm Byz-Known-Size, this implies 
agent A is red in round x — 1 or there is a tower Tj in round x — 1 for some j < T{EXPLO{n)) — 1. In the 
first case, we can show as above that the delay between the starting rounds of agents A and B is greater than 
T{EXPLO{n)) in round x — l which is a contradiction with Proposition 13.11 So let us focus on the second 
case in which there is a tower Tj in round x — l. According to Algorithm Byz-Known-Size, agent A tests 
configuration pi in round x — l. Since the lemma holds in round x — 1, we then know that all good agents of 
tower Tj also test configuration pi in round x — l: among them there is at least one good agent C that enters 
state tower of phase i from substate red of phase i in some round x' < x — 1 in view of Lemma [3^ Hence 
in round X — 1 agent C has spent at most 2T{EXPLO{n)) + {i — l)*Q{n) + 3T{EXPLO{n)) + An+j < 
2T{EXPL0{n)) + {i — l)*Q{n) +AT{EXPLO{n))+An rounds since its wake up in view of Lemma l3.ll 
while agent B has spent at least 2T{EXPL0{n)) + {i — 1) * Q{n) + {10T{EXPLO{n)) + 9n) — 1. As 
before, we get a contradiction with Proposition 13.11 Thus, agent B does not test a configuration pj in round 
X such that j > i. 

We then get a contradiction in all cases, which proves the lemma. 
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□ 


Lemma 3.4 Let Abe a good agent entering state tower from state tower builder in round r at node 
V. Let B be a good agent that does not declare that gathering is over before round r and that does not enter 
state tower from state tower builder in round r at node v. Agent B is in state wait-f or-a-tower 
in round r. 

Proof. Assume by contradiction that there exists some round x (playing the role of round r in the statement 
of the lemma) such that the lemma does not hold. Without loss of generality, let us assume that x is the first 
round for which this lemma is false. Let pi be the configuration that is tested by agent A in round x. Let k 
be the number of labels in configuration pi (recall that all the labels in configuration pi are distinct as they 
are meant to represent only the labels of good agents). According to Lemma [331 we know that agent B also 
tests configuration pi in round x. To get a contradiction, we will prove that agent B cannot be in any state 
of phase i in round x except state wait-f or-a-tower. 

Agent B cannot be in state setup of phase i in round x. Indeed, since agents A and B do not declare 
that gathering is over before round x, in view of Lemma ITT] and Proposition 13.11 we know that the delay 
between the two rounds in which they start testing configuration pi is at most T{EXPLO{n)). However by 
Proposition 13.21 agent B cannot spend more than n rounds in state setup of phase i, while agent A needs 
to spend at least T{EXPLO{n)) + re + 2 rounds in phase i before entering state tower of phase i. Hence 
agent B cannot be in state setup in round x, otherwise we would get a contradiction with the fact that the 
delay between the two rounds in which they start testing configuration pi is at most T{EXPLO{n)). 

In round x agent B cannot be in state tower of phase i. To show this, we first prove that in round x agent 
B cannot be in state tower of phase i with index 0 (we will then prove it cannot be in this state even with 
any positive index). If in round x agent B is in state tower of phase i with index 0, then according to 
Algorithm Byz-Known-Size agents A and B are red in round x — 1 and enter state tower in round x. In 
round x — 1, agents A and B are not at the same node, otherwise according to Algorithm Byz-Known-Size 
they are still together in round x and we then get a contradiction with the assumption that agent B does not 
enter state tower from state tower builder in the same round and at the same node as agent A. Hence 
in round x — 1 agents A and B are red at distinct nodes and decide to transit to state tower: according 
to Lemmathey do so by testing the same configuration p*. According to Algorithm Byz-Known-Size, 
there are then at least 2k red agents in round x — 1: a group of at least k at the node where agent A is 
located, and another group of at least k at the node of agent B. Since k > / + 1, there is at least k + \ 
good agents that are red in round x — 1. Thus, according to Lemma [331 there are at least k + 1 good 
agents that are red in round x — \ which test the same configuration pi. However, this implies that each 
of these good red agents has its label in configuration pi (otherwise it would have been impossible for at 
least one of them to transit to state tower builder of phase i according to the rules of state setup): 
there are then at least k + 1 distinct labels in pi which contradicts the definition of k. Let us now prove that 
in round x agent B cannot be in state tower and have an index j > 0. If agent B is in state tower of 
phase i and has index j > 0 in round x, then, in view of Lemma [T2l there is a good agent C in state tower 
having index j — 1 in round x — I which has been in state tower since round x — j. Hence, in round 
x — j agent C would be in state tower with index 0, which means that agent C enters state tower from 
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state tower builder in round x — j according to Algorithm Byz-Known-Size. Since index j cannot 
be greater than T{EXPLO[n)), we know from Algorithm Byz-Known-Size that agent A is red in round 
X — j as it necessarily spent T{EXPLO{n)) + n rounds as a red agents before entering state tower in 
round x. Hence in round x — j, there is an agent C that enters state tower while agent A is red in state 
tower builder: the lemma does not hold in round x — j, which contradicts the fact that x is the first 
round when the lemma is false. 

Now that the cases setup and tower have been excluded, it remains to prove that in phase i, agent B 
cannot be either in state tower builder or in state failure. 

Let us first prove that agent B cannot be in state tower builder of phase i in round x. To prove this, it 
is enough to show that it cannot be either yellow, or orange, or red. 

If in round x agent B is yellow and tests configuration pi, it cannot be yellow and test configuration pi 
in round x — T{EXPLO{n)) — n — 1. Hence when in round x — T{EXPLO{n)) — n — 1, agent B has 
spent at most 2T{EXPLO{n)) -I- (f — 1) * Q{n) + n rounds since its wake up in view of Algorithm Byz- 
Known-Size, Proposition 13.21 and Lemma l3T] However, according to Algorithm Byz-Known-Size, when in 
round x — T{EXPLO{n)) — n — 1, agent A is yellow or orange, tests configuration pi and sees at least 
k orange agents at its current node. From Lemma [331 and the fact that k > f + 1, there is a good agent 
C that is orange and tests configuration pi in round x — T{EXPLO{n)) —n — 1. When in this round, 
by Lemma inl and Proposition [331 agent C has spent at least 3T{EXPLO{n)) -|- (z — 1) * Q{n) + n -|- 1 
rounds since its wake up (i.e. at least T{EXPLO{n)) + 1 rounds more than agent B), which contradicts 
Proposition 13.11 

In round x agent B cannot be orange. Indeed, if agent B is orange in round x, then according to 
Algorithm Byz-Known-Size and Lemma[33]we have the following fact: there are at least k agents such that 
each of them is either yellow or orange in round x — 1 which test the same configuration pi, and there 
are at least A: red agents in round x — 1 which test the same configuration pi. Since k > f + 1, there are at 
least A: -|- 1 good agents that are in state tower builder in round x — 1 which test the same configuration 
Pi. However, this implies that each of these good agents has its label in configuration pi (otherwise it is 
impossible to transit to state tower builder of phase i according to the rules of state setup): there are 
then at least A; -|- 1 distinct labels in pi which contradicts the definition of k. In round x, agent B cannot be 
red. Indeed, if agent H is red in round x that means there is a round x — p {p < T{EXPLO{n)) + re) in 
which it is in a group of at least k agents having a color belonging to {yellow, orange} while agent A is in 
a group of at least A; red agents. From this point, using similar arguments to those used just above to prove 
agent B is not orange in round x, we get a contradiction with the definition of k. 

To end the proof, it remains to show that agent B is not in state failure of phase i in round x. Assume 
by contradiction, it is in state failure of phase i in round x. Let x' < x he. the last time agent B decided 
to transit to state failure (recall that when an agent decides to transit from some state X to some state 
Y in some round t, the agent remains in state X in round t and is in state Y in round t + 1). In round x', 
agent B is either in state tower of phase i or in state wait-f or-a-tower of phase i. If agent B is 
in state wait-f or-a-tower of phase i and decides to transit to state failure in round x', then by 
Lemma IrTl Proposition 13.21 and Algorithm Byz-Known-Size, when in round x agent B has spent at least 
2T{EXPLO{n)) + (z — l)Q{n) + 5T{EXPLO{n)) + 4re rounds since its wake up. However still by 
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Lemma IXn Proposition 13.21 and Algorithm Byz-Known-Size, when in round x agent A has spent at most 
2T{EXPLO{n)) + {i — l)Q{n) + 3T{EXPLO{n)) + 4re + 1 rounds since its wake up, which contradicts 
Proposition 13.11 If agent B is in state tower of phase i with some index j > 0 in round x', then in 
view of Lemmas [3i2] and [33] as well as Algorithm Byz-Known-Size, we know there is a good agent C (not 
necessarily different from agent B) that enters state tower of phase i from state tower builder of 
phase i in round x' — j. Hence in view of Lemma [33] and the fact the lemma holds in all rounds prior to 
round x, in round x' — j agent A either also enters state tower of phase i from state tower builder 
of phase i, or is in state wait-for-a-tower of phase i. However in both these cases, it is then impossible for 
agent A to enter state tower of phase i from state tower builder of phase i in round x according to 
Algorithm Byz-Known-Size, which is a contradiction. 

Thus, agent B can be only in state wait-for-a-tower of phase i in round x, which proves the lemma. 

□ 


Lemma 3.5 In any round there is at most one tower. 

Proof. Assume by contradiction there exists some round r when there are two distinct towers Vj and Tk- 
The members of Vj (resp. Tk) are in state tower and all have index j (resp. index k). Note that in the case 
where Vj and Tk are at the same node, indexes j and k are different from each other, otherwise we would 
have Vj = Tk according to the definition of a tower. In the other case, index j is not necessarily different to 
index k. Without loss of generality, we assume in the rest of this proof that j > k. By Lemma [33] there is 
a good agent A G Vj (resp. B G Tk) which has been in state tower since round r — j (resp. round r — k). 
Let Pi be the configuration tested by agent A in round r. By Lemma [33] agent B also tests configuration pi 
in round r. Hence, in view of the fact that agent A (resp. agent B) is in state tower of phase i with index j 
(resp. index k) in round r, agent A (resp. agent B) enters state tower of phase i in round r — j (resp. round 
r — k) from state tower builder of phase i. Denote by u the node occupied by agent A in round r — j. 
By Lemmas [3.3! and [T4l in round r — j agent B is either in state wait-for-a-tower of phase i or also 
enters state tower of phase i from state tower builder at node u. The first case implies that agent B 
cannot enter state tower of phase i from state wait-for-a-tower of phase i in round r — k, which is 
a contradiction. The second case implies that agents A and B enter together state tower of phase i from 
state state tower builder in the same round r—j = r — k and at the same node, and thus belong to 
the same tower in round r according to Algorithm Byz-Known-Size, which is also a contradiction and thus 
proves the lemma. 

□ 


We are now ready to prove Lemmas [3.6! and [T7] 

Lemma 3.6 If a good agent declares gathering is over at node v in round r, then all good agents are at 
node V in round r and declare that gathering is over in round r. 

Proof. Assume by contradiction there is a good agent A that declares gathering is over at node v in round r 
but there is a good agent B that does not make such a declaration at the same node and in the same round. 
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Without loss of generality, we assume round r is the first round when an agent declares gathering is over. 
Thus, agent B does not declare gathering is over before round r. 

According to Algorithm Byz-Known-Size, there is a tower Tp(„) in round r at node v: all agents belonging 
to 7p(„) are in state tower and have index P{n) (which corresponds to the number of edge traversals of 
procedure EXPLO{n)). By Lemmathere is a good agent C that proceeded to an entire execution of 
EXPLO{n) from round r — P{n) to round r. None of agents in 7p(„) could be agent B because all good 
agents belonging to 7p(„) in round r declare gathering is over according to the rules of state tower. In 
particular agent C cannot be agent B. When agent C enters state tower in round r — P{n), agent B is in 
state wait-f or-a-tower, otherwise in view of Lemma [T4l and Algorithm Byz-Known-Size, agents C 
and B both belong to Tp(jiy which is a contradiction. 

If agent B does not enter state failure in some round of {r — P{n) -|- 1, ■ ■ ■ , r}, then either agent B 
remains in state wait-f or-a-tower from round r — P{n) to round r, or agent B enters state tower 
in some round a; G {r — P{n) -|- 1, • • • , r}. In the former case, that means agent B is at node v in round 
r. Indeed, otherwise agent B shares with agent C the same node (because C makes an entire traversal as 
an agent in state tower) in some round x G {r — P{n), • • • , r — 1}, and then transits to state tower in 
round x + 1 < r (because agent C is always in a tower during its entire traversal), which is a contradiction. 
However due to the presence of a tower in round r at node v, agent B declares gathering is over in the 
same round and at the same node according to the rules of state wait-f or-a-tower, which is again a 
contradiction. In the latter case, agent B enters state tower in some round x G {r — P{n) + 1, • • • , r}. By 
Lemma [L5] and the fact that agent C is always in state tower from round r — P[n) to r, agent B belongs 
to the same tower as agent C from rounds x to r. Thus agent B is included in tower 7p(„) in round r, which 
is a contradiction. 

Hence agent B enters state failure in some round x G {r — P{n) -|- 1, • • • , r}. By Lemmaagents 
A, B and C test the same configuration pi in round r for some positive integer i. According to Algorithm 
Byz-Known-Size, we know agent C also tests configuration pi in round x. Since agent C is in state tower 
in round x, agent B also tests configuration pi in round x, according to Lemma |33] Hence in view of the 
fact that agent B enters state failure by testing configuration pi in round x and the fact that it still tests 
configuration pi in round r, we know that agent B is in state failure of phase i in round r. However by 
Lemma l3Tl Proposition 13.21 and Algorithm Byz-Known-Size, when in round r, agent B has spent at least 
2T{EXPLO{n)) -I- (i — 1) * Q{n) -|- 5T{EXPLO{n)) -|- 4n -I- 1 rounds since its wake up, while agent 
C has spent at most 2T{EXPLO{n)) -|- (f — 1) * Q{n) + 4T{EXPLO{n)) + An rounds: we thus get a 
contradiction with Proposition 13.11 Hence agent B does not exist and the lemma holds. 

□ 


Lemma 3.7 There is at least one good agent that ends up declaring that gathering is over. 

Proof. Assume by contradiction no agent ends up declaring gathering is over. Let pi be a configuration, 
belonging to enumeration 0, which corresponds to the initial configuration of all good agents in the graph. 
Configuration pi is said to be good. Let k be the number of labels in configuration pp. k > f + I be¬ 
cause every tested configuration contains at least f + I labels. Since configuration pi is good, in view of 
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Proposition 13.11 Lemma 13.11 and the fact that at least one good agent is woken up by the adversary, ev¬ 
ery good agent reaches state tower builder of phase i possibly in different rounds but at the same 
node V corresponding to the node where the agent having the smallest label is initially located. De¬ 
note by A the first agent to enter state tower builder of phase i in some round r. Agent A is thus 
yellow in round r at node v. By Propositions 13.II and 13.21 Lemma [LT] and the fact that configuration pi 
is good, we know that each of all good agents enters substate yellow of phase i at node v in some round 
X G {l ■ • • ) ^ + T{EXPLO{n)) -|- re — 1}. Note that if a good agent, which is in substate yellow of 
phase i in round x' £ {r, ■■■ ,r + T{EXPLO{n)) -|- re — 2} at node v, is no longer in substate yellow 
of phase i in round x' -|- 1 at node v, this implies that the good agent sees at least k orange agents at 
node V in round x'. Among this group of at least k orange agents, at least one agent, call it C, is good as 
A: > / -|- 1. By Lemmaagent C also tests configuration pi in round x', and thus agent C entered state 
tower builder of phase i in round x' — T{EXPLO{n)) — re — 1 < r at the latest, which contradicts 
the definition of agent A. Hence, each of all good agents enters substate yellow of phase i at node v in 
some round x G {r, • • • , r + T{EXPLO[n)) -|- re — 1} and remains in substate yellow of phase i at node 
V at least until round r + T{EXPLO[n)) + n — 1 included. We have therefore the following claim. 

Claim 1. All good agents are yellow at node v and test configuration pi in round r + T{EXPLO{n)) + 
re — 1. 

From Claim 1 and Algorithm Byz-Known-Size, the k good agents become red together before round 
r + 2T{EXPLO{n)) -|- 2re. From this point, we know the k good agents will then enter state tower 
of phase i in the same round at node v and make together an entire execution of procedure EXPLO{n): 
according to the rules of state tower, agent A declares gathering is over at the end of this execution. So, 
we get a contradiction, and the lemma holds. □ 

From Lemmas 13.61 and lL7l we know that Algorithm Byz-Known-Size and Theorem [33] are valid. 

4 Unknown graph size 

In this section, we consider the same problem, except we assume that the agents are not initially given the 
size of the graph. Under this harder scenario, we aim at proving the following theorem. 

Theorem 4.1 Deterministic f-Byzantine gathering of k good agents is possible in any graph of unknown 
size if and only ifk>f + 2. 

As mentioned in Subsection [O] we know from ifldl that: 

Theorem 4.2 ( Ill4l l Deterministic f-Byzantine gathering of k good agents is not possible in some graphs 
of unknown size ifk<f-\-\. 

In view of Theorem 14.21 it is then enough to show the following theorem in order to prove Theorem 14. II 

Theorem 4.3 Deterministic f-Byzantine gathering of k good agents is possible in any graph of unknown 
size ifk>f-\-2. 

Hence, similarly as in Section (3] the rest of this section is devoted to showing a deterministic algorithm that 
gathers all good agents, but this time in an arbitrary network of unknown size and provided there are at least 
/ -|- 2 good agents. 
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Before giving the algorithm, which we call Algorithm Byz-Unknown-Size, let us provide some intuitive 
ingredients on which our solution is based. 

The algorithm of this section displays a number of similarities with the algorithm of the previous section, but 
there are also a number of changes to tackle the non-knowledge of the network size. Among the most notable 
changes, there is firstly the way of enumerating the configurations. Previously, the agents were considering 
the enumeration 0 = {pi, p 2 , P'i-,- ■ ■) of V where V is the set of every configuration corresponding to 
a n-node graph in which there are at least / + 1 robots with pairwise distinct labels. Now, instead of 
considering 0, the agents will consider the enumeration 02) </’3) • ‘ ‘) of 2 where Q is the set of 

all configurations corresponding to a graph of any size (instead of size n only) in which there are at least 
/ + 2 agents (instead of at least / + 1) with pairwise distinct labels. Note that, as for set V, set Q is also 
recursively enumerable. 

Another change stems from the function performed by a tower, which we also find here. In Algorifhm 
Byz-Known-Size, fhe role of a lower was fo fefch all awailing good agenfs (which know lhal Ihe tested con¬ 
figuration is nof good) via procedure EXPLO{n): in fhe new algorifhm, we keep fhe exacl same slralegy. 
However, lo be able lo use procedure EXPLO wilh a paramefer corresponding lo fhe size of fhe nelwork, 
if is necessary, for fhe good agenfs lhal are members of a lower, lo know Ibis size. Hence, in our solulion, 
before being considered as a lower and Ihen aulhorized fo make a Iraversal of fhe graph, a group of agenfs 
will have lo learn fhe size of fhe graph. To do Ihis, af leasl each good agenl of fhe group will be required lo 
make a simulalion of procedure EST by playing fhe role of an explorer and using fhe olhers as ils loken. 
To carry oul Ihese simulations, if is also required for fhe group of agents to contain initially at least f + 2 
members (explorer -i- token), even if subsequently it is required for a group of agents forming a tower to 
contain at least f + 1 members. Our algorithm is designed in such a way that if during the simulation of 
procedure EST by an agent playing the role of an explorer, we have the guarantee there are always at least 
f + I agents playing the role of its token, then the explorer will be able to recognize its own token without 
any ambiguity (and thus will act as if it performed procedure EST with a “genuine” token). Of course, 
the agents will not always have such a guarantee (especially due to the possible bad behavior of Byzantine 
agents when testing a wrong configuration) and will not be able to detect in advance whether they will have 
it or not. Besides, some other problems can arise including, for example, some Byzantine explorer which 
takes too much time to explore the graph (or worse still, “never finishes” the exploration). However we will 
show that in all cases, the good agents can never learn an erroneous size of the graph (even with the duplic¬ 
ity of Byzantine agents when testing a wrong configuration). We also show that good agents are assured of 
learning the size of the network when testing a good configuration at the latest (as the creation of a group of 
at least f + 2 agents and the aforementioned guarantee are ensured when testing a good configuration). As 
for Algorithm Byz-known-Size, in the worst case the good agents will have to wait until assuming a good 
hypothesis about the real initial configuration, in order to declare gathering is over. 

Despite the fact Algorithm Byz-Unknown-Size has also a number of technical changes compared with Algo¬ 
rithm Byz-Known-Size (e.g., the duration of waiting periods that are adjusted according to the new context), 
it should be noted that some parts of Algorithm Byz-Unknown-Size are inevitably almost identical to some 
of those of Algorithm Byz-known-Size (this is particularly the case for the description of state tower). 
However for easy readability, we made the choice of writing completely these parts instead of explaining 
this or that part “is the same as in Algorithm Byz-Known-Size except that...”. 
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We now give a detailed description of the algorithm. 

Algorithm Byz-Unknown-Size 

The agent works in phases numbered 1, 2, 3, • • •. During the execution of each phase, the agent can be in one 
of the following seven states: setup, tower builder, token, explorer, tower, wait-f or-a-tower, 
failure. Below we describe the actions of an agent A having label I a in each of the states as well as the 
transitions between these states within phase i. As in Algorithm Byz-Known-Size, we assume that in every 
round agent A tells the others (sharing the same node as agent A) in which state it is. At the beginning 
of phase i, agent A enters state setup. We denote by Q the time spent by agent A executing Algorithm 
Byz-Unknown-Size before starting phase i. 

State setup. 

Let be the Lth configuration of enumeration D = ■'') (refer to its description given in 

Section |4|. Let n* be the number of nodes in configuration Agent A starts executing procedure 
EXPLO{ni). Once the execution of EXPLO{ni) is accomplished, the agent backtracks to its starting 
node by traversing all edges traversed in EXPLO{ni) in the reverse order and the reverse direction. When 
the backtrack is done, the agent continues with this state via the following rules. If I a is not in (/)j, then 
it transits to state walt-for-a-tower. Otherwise, let X be the set of the shortest paths in (f)i leading 
from the node containing the agent having label I a, to the node containing the smallest label of the supposed 
configuration. Each of paths belonging to X is represented as the corresponding sequence of port numbers. 

Let TT be the lexicographically smallest path in X (the lexicographic order can be defined using the total 
order on the port numbers). Agent A follows path vr in the real network. If, following path vr, agent A has 
to leave by a port number that does not exist in the node where it currently resides, then it transits to state 
wait-f or-a-tower. In the same way, it also transits to state wait-f or-a-tower if, following path 
vr, agent A enters at some point a node by a port number which is not the same as that of path vr. Once path 
vr is entirely followed by agent A, it transits to state tower builder. 

State tower builder. 

When in state tower builder, agent A can be in one of the following three substates: yellow, 
orange, red. In all of these substates the agent does not make any move: it stays at the same node 
denoted by v. At the beginning, agent A enters substate yellow. As for Algorithm Byz-Known-Size, we 
will sometimes use a slight misuse of language by saying an agent “is yellow” instead of “is in substate 
yellow”. We will also use the same kind of shortcut for the two other colors. In addition to its state, we 
also assume that in every round agent A tells the others in which substate it is. 

Substate yellow 

Let k be the number of labels in configuration (jii. Agent A waits T{EXPLO{ni)) + rii + Q rounds. If 
during this waiting period, there are at some point at least k orange agents at node v then agent A transits to 
substate red. Otherwise, if at the end of this waiting period there are not at least k agents residing at node v 
such that each of them is either yellow or orange, then agent A transits to state wait-f or-a-tower, 
else it transits to substate orange. 

Substate orange 
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Agent A waits at most T{EXPLO{ni)) + ni + Q rounds to see the occurrence of one of the following two 
events. The first event is that there are not at least k agents residing at node v such that each of them is either 
yellow or orange. The second event is that there are at least k orange agents residing at node v. Note 
that the two events cannot occur in the same round. If during this waiting period, the first (resp. second) 
event occurs then agent A transits to state wait-f or-a-tower (resp. substate red). If at the end of the 
waiting period, none of these events has occurred, then agent A transits to substate wait-f or-a-tower. 

Substate red 

Agent A waits T{EXPLO{ni)) + n* -\-T{EST{ni)) + Q rounds, and in every round of this waiting period 
it tells the others the phase number i. If there is a round during the waiting period in which there are not at 
least k red agents in phase i at node v. agent A then transits to state wait-f or-a-tower as soon as it 
notices this fact. Otherwise, at the end of the waiting period agent A transits either to state explorer, or 
to state token, or to state failure according to the following rule. Let T-L be the set of pairwise distinct 
labels such that Z G iff there is at least one red agent in phase i having label I at node v in the last round 
of the waiting period. Let IT-L] be the cardinality of T-L. If IT-L] > Ui then agent A transits to state failure. 
Otherwise | < rij and agent A applies the following instruction: if I a is the smallest label in T-L then agent 
A transits to state explorer, else it transits to state token. 

State explorer. 

We first briefly describe fhe procedure EST based on 161 fhaf will be subsequenfly adapted fo our needs. In 
fhis procedure, fhe agenf consfrucfs a BPS free roofed af node r marked by fhe sfafionary token. In fhis free 
if marks porf numbers af all nodes. During fhe BPS fraversal, some nodes are added fo fhe BPS free. In fhe 
beginning, fhe agenf adds fhe roof r and fhen if makes fhe process of r. The process of a node w consisfs 
in checking all fhe neighbors of w in order fo determine whefher some of fhem have fo be added fo fhe free 
or nof. When an agenf sfarfs fhe process of a node w, if goes fo fhe neighbor reachable via porf 0 and fhen 
checks fhe neighbor. 

When a neighbor x of w gefs checked, fhe agenf verifies if x is equal fo some node previously added fo 
fhe free. To do fhis, for each node u belonging fo fhe currenf BPS free, fhe agenf fravels from x using fhe 
reversal q of fhe shorfesf pafh q from r fo u in fhe BPS free (fhe pafh g is a sequence of porf numbers). If af 
fhe end of fhis backfrack if meefs fhe foken, fhen x = u: in fhis case x is nof added fo fhe free as a neighbor 
of w and is called w-rejected. If nof, fhen x ^ u. Whefher node x is rejected or nof, fhe agenf fhen comes 
back fo X using fhe pafh q. If x is differenl from all fhe nodes of fhe BPS free, fhen if is added fo fhe free. 

Once node x is added fo fhe free or rejected, fhe agenf makes an edge fraversal in order fo be located af w 
and fhen goes fo a non-checked neighbor of w, if any. The order, in which fhe neighbors of w are checked, 
follows fhe increasing order of fhe porf numbers of w. 

When all fhe neighbors of w are checked, fhe agenf proceeds as follows. Lef X be fhe sef of fhe shorfesf 
pafhs in fhe BPS free leading from fhe roof r fo a node y having non-checked neighbors. If X is empty fhen 
procedure EST is completed. Ofherwise, fhe agenf goes fo fhe roof r, using fhe shorfesf pafh from it; fo r in 
the BPS tree, and then goes to a node y having non-checked neighbors, using the lexicographically smallest 
path from X. Prom there, the agent starts the process of y. 

We are now ready to give the description of state explorer. 
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When entering this state, agent A executes the procedure EST' which corresponds to a simulation of proce¬ 
dure EST with the following three changes. The first change concerns meetings with the token. Consider a 
verification if a node x, which is getting checked, is equal to some previously added node u. This verifica¬ 
tion consists in traveling from x using the reverse path q, where q is the path from the root r to u in the BPS 
tree and checking the presence of the token. If at the end of the simulation of path q in EST' , agent A is at 
a node containing at least f + 1 agents in state token of phase i, then it acts as if it saw the token in EST', 
otherwise it acts as if it did not see the token in EST. The second change occurs during the construction 
of the BPS tree: if at some point agent A has added more than rii nodes in the BPS tree or has spent more 
than T{EST{ni)) rounds executing the current simulation, then it drops the simulation and transits to state 
failure. The third and final change occurs af fhe end of fhe simulafion: if agenf A has added less fhan rii 
nodes in fhe BPS free, fhen if fransifs fo sfafe failure. 

Once fhe execufion of procedure EST' is done, agenf A backfracks fo fhe node where if was locafed when 
enfering sfafe explorer. To do fhis, fhe agenf fraverses all edges fraversed during fhe execution of pro¬ 
cedure EST' in fhe reverse order and fhe reverse direcfion. When fhe backfrack is done, agenf A has spenf 
exacfly 2T{EST {rii)) — t rounds in sfafe explorer of phase i, for some infeger t > 0. Prom fhis poinf, agenf 
A waifs t rounds. Af fhe end of fhe waiting period, if agenf A does nof share ifs currenf node wifh af leasf 
f + l agenf s in sfafe token of phase i, fhen if fransifs fo sfafe failure. Ofherwise agenf A does shai'e ifs 
currenf node wifh af least f + l agents in state token of phase i: in this case, if Ia is the largest label in set 
Ti (this set was determined when agent A was red in this phase) then agent A transits to state tower, else 
it transits to state token. 

State token. 

While in this state, agent A remains at the same node v, and in every round it tells the others the phase num¬ 
ber i. Agent A can transit to state token either from state tower builder or from state explorer. 
Below, we distinguish both these cases. Let j be the number of labels of Ti that are smaller than Ia- 

• Case 1: the last time agent A transited to state token was from state tower builder. In this 
case agent A waits 2j.T{EST{ni)) rounds. If there is a round during the waiting period in which 
there are not at least / -I- 1 agents in state token of phase i at node v: agent A then transits to state 
failure as soon as it notices this fact. Otherwise, at the end of the waiting period agent A transits 
to state explorer. 

• Case 2: the last time agent A transited to state token was from state explorer. In this case agent 
A waits 2(12^1 — j — l).T{EST{ni)) rounds. If there is a round during the waiting period in which 
there are not at least f E I agents in state token of phase i at node v: agent A then transits to state 
failure as soon as it notices this fact. Otherwise, at the end of the waiting period agent A transits 
to state tower. 


State tower. 

Agent A can enter state tower either from state token, or state explorer or state wait-f or-a-tower 
While in this state, agent A will execute all or part of procedure EXPLO{ni). In all cases we assume that, 
in every round, agent A tells the others the edge traversal number of EXPLO{ni) it has just made (in addi- 
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tion to its state). We call this number the index of the agent. Below, we distinguish and detail the case when 
agent A enters state tower from state token or explorer, and the case when it enters state tower 
from state wait-f or-a-tower. 

When agent A enters state tower from state token or explorer, it starts executing procedure EXPLO{ni). 
In the first round, its index is 0. Just after making the j-th edge traversal of EXPLO{ni), its index is j. 
Agent A carries out the execution of EXPLO{ni) until its term, except if at some round of the execution 
the following condition is not satisfied, in which case agent A transits to state failure. Here is the condi¬ 
tion: the node where agent A is currently located contains a group S of at least / + 1 agents in state tower 
having the same index as agent A. S includes agent A but every agent that is in the same node as agent A is 
not necessarily in S. If at some point this condition is satisfied and the index of agent A is equal to P{ni), 
which is the total number of edge traversals in EXPLO{ni) (refer to Section|2l), then agent A declares that 
gathering is over. 

When agent A enters state tower from state wait-f or-a-tower, it has just made the s-th edge traversal 
of EXPLO{ni) for some s (cf. state wait-f or-a-tower) and thus, its index is s. Agent A executes 
the next edge traversals i.e., the s + 1-th, s + 2-th, • • •, and then its index is successively s + 1, s + 2, etc. 
Agent A carries out this execution until the end of procedure EXPLO{ni), except if the same condition as 
above is not fulfilled af some round of the execution of the procedure, in which case agent A also transits to 
state failure. As in the first case, if at some point the node where agent A is currently located contains a 
group S of at least f + 1 agents in state tower having an index equal to P{ni), then agent A declares that 
gathering is over. 

State wait-f or-a-tower. 

Agent A waits at most 7T{EXPLO{ni)) + Ani + (2nj -|- l)T{EST{ni)) + 4:Q rounds to see the occurrence 
of the following event: the node where it is currently located contains a group of at least f + l agents in state 
tower having the same index t. If during this waiting period, agent A sees such an event, we distinguish 
two cases. If t < P{ni), then it makes the t + 1-th edge traversal of procedure EXPLO{ni) and transits to 
state tower. If f = P{ni), then it declares that gathering is over. 

Otherwise, at the end of the waiting period, agent A has not seen such an event, and thus it transits to state 

failure. 

State failure. 

Agent A backtracks to the node where it was located at the beginning of phase i. To do this, agent A traverses 
in the reverse order and the reverse direction all edges it has traversed in phase i before entering state 
failure. Once at its stalling node, agent A waits lQT{EXPLO{ni)) + drii + 2(nj -|- l)T{EST{ni)) + 

7Q — p rounds where p is the number of elapsed rounds between the beginning of phase i and the end of the 
backtrack it has just made. At the end of the waiting period, phase i is over. In the next round, agent A will 
start phase i + 1. 

4.1 Proof of correctness 

The purpose of this section is to prove that Algorithm Byz-Unknown-Size is correct and that by extension 
Theorem 14.31 holds. 
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For any positive integer i, we say that a good agent A tests configuration (pi when it executes the f-th phase 
of Algorithm Byz-Unknown-Size. We denote by rii the size of the graph in configuration (pi and by n the 
(unknown) size of the network where the agents currently evolve. We assume that the smallest integer i such 
that rij > n is a. 

According to state failure, we have the following proposition. 

Proposition 4.1 At the beginning of every phase it executes, a good agent is at the node where it was woken 
up. 

Lemma 4.1 Let Abe a good agent which starts executing the i-th phase of Algorithm Byz-Unknown-Size 
in some round r. Let Z{ni) = 16T{EXPLO{ni)) + 9ni + 2(nj + l)T{EST{ni)) + 7Q where Q is the 
number of rounds spent by agent A executing the algorithm before round r. The following two properties 
hold. 


• Property 1. Agent A either spends exactly Z[ni) rounds executing the i-th phase or it will declare 
that gathering is over after having spent at most Z{ni) rounds in the i-th phase. 

• Property 2. Let B be a good agent different from agent A which starts executing the i-th phase 
of Algorithm Byz-Unknown-Size in some round r' (round r' is not necessarily different from round 
r). Agent B has also spent exactly Q rounds executing Algorithm Byz-Unknown-Size before starting 
phase i. 

Proof. Using similar arguments to those used in the proof of Lemma lXTl we can prove that the first property 
holds. Concerning the second property, it is a corollary of the first property. □ 

In view of Lemma 14.11 we know that for every integer i, the good agents that do not declare gathering is 
over before entering phase i, all spend the exact same time executing Algorithm Byz-Unknown-Size before 
entering phase i (whether they enter it in the same round or not). In the rest of this section, we denote by 
Qj the number of rounds spent before entering phase j by any agent that does not declare gathering is over 
before starting the j-th phase of Algorithm Byz-Unknown-Size. 

Proposition 4.2 Let A and B be two good agents such that agent A is woken up by the time agent B is 
woken up. If agent A does not declare gathering is over before starting phase a, then the delay between the 
starting rounds of agents A and B is at most Qa + T(EXPLO(na)). 

Proof. If agent A is woken up in some round, it ends up starting phase a after having spent exactly Qa 
rounds. When entering phase a, agent A is in state setup and first execute procedure EXPLO{na) 
according to Algorithm Byz-Unknown-Size. Since by definition > re, then the propositions holds. □ 

Even if Algorithm Byz-Unknown-Size has several changes compared with Algorithm Byz-known-Size (in 
particular the two extra states explorer and token to take into account here), we can prove Lemmas [4.21 
14.31 and l4~4l bv using similar arguments to those used in the proofs of Lemmas l3.21l331 and l3.41 
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Lemma 4.2 Let Tj be a tower located at node v in round t. There is at least one good agent in Tj which 
has been in state tower since round t — j. 

Lemma 4.3 Let A be a good agent that is either orange, or red or in a state G {tower, token, 
explorer} in round r. Let (/>j be the configuration tested by agent A in round r. If i > a, then all good 
agents, which do not declare gathering is over before round r, test fi in round r. 


Lemma 4.4 Let Abe a good agent entering state explorer or token/rom state tower builder in 
round r at node v by testing a configuration fii such that i> a. Let B be a good agent that does not declare 
that gathering is over before round r and that does not enter state explorer or token/rom state tower 
builder in round r at node v. Agent B is in state wait-f or-a-tower in round r. 


Lemma 4.5 Let Abe a good agent that tests configuration in round r. If agent A enters state tower 
from state token or explorer in round r then n* = n. 

Proof. 

Let us first consider the case where agent A enters state tower from state explorer in round r. According 
to Algorithm Byz-Unknown-Size agent A computed a BPS tree T while in state explorer (just before 
transiting to state tower of phase i). Before going any further, we need to prove the following claim. 

Claim 1. The size m of T is such that m = n. 

If Ui = n then the claim is true because according to Algorithm Byz-Unknown-Size agent A can transit 
from state explorer to state tower in round r only if m = n*. So let us focus on the case where n* / n. 
Denote by u the node of the graph corresponding to the root of T. Denote by T' the BPS tree rooted at a 
node corresponding to node u and that would result from the execution of procedure EST by an explorer 
having its own token at node u which cannot disappear and which cannot be confused with another token. 
The size of T' is therefore equal to n. If T is identical to T' , then m = n. However note that since n* n, 
we have m rii and thus agent A cannot transit from state explorer to state tower in round r according 
to Algorithm Byz-Unknown-Size which is a contradiction with the definition of r. 

Therefore T is necessarily different from T' . There are only two possible incidents that can lead to such a 
situation, according to the definition of T. The first one is that at some point during the exploration of agent 
A, its token vanished i.e, there is a round during the exploration when there are not f + I agents at node u 
that claim being in state token of phase i. The other one is that at some point agent A confused its token 
with another token i.e., it encountered during its exploration a group of at least f + l agents at a node v u 
that claimed being in state token of phase i. However note that any execution of procedure EST' consists 
of alternating periods of two different types. The first type corresponds to periods when the agent processes 
a node and the second type corresponds to those when the agent moves to the next node to process it. During 
the periods of the second type, an agent does not use any token to move: it follows the same path regardless 
of whether it meets some token or not on its path. Hence, each of the two possible incidents describe above 
can only have an impact on the BPS tree only if they occur during a period of the first type when verifying 
whether a node has to be rejected or not. So denote by t the first round in the construction of T via procedure 
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EST' when agent A adds a node to its BPS tree T under construction that has to he rejected, or when agent 
A rejects a node that has to be added to its BPS tree T under construction. This round necessarily exists as 
otherwise T' could not be different from T according to the above explanations. We consider the only two 
possible cases (each of them leading to a contradiction). Let k be the number of labels in configuration pi. 

• Case 1: in round t agent A rejects a node x that has to be added to its BPS tree T under construction. 
This can occur only if agent A encounters by round t during its exploration a group of at least / + 1 
agents at a node v ^ u that claim being in state token of phase i. Among these agents there is 
necessary at least one good agent B. Denote by t' the last round before round t such that agent A is 
not in state explorer. According to Algorithm Byz-Unknown-Size, t' >t — T{EST{ni)) — 1, and 
thus in round t' agent B is either in substate red of phase i (at node v), or in state token of phase i 
(at node v), or in state explorer of phase i. Now denote by t" the last round such that t" < t' and 
such that agent A or S is in substate red of phase i. Let us first assume that agent B is in substate 
red of phase i in round t": in this round agent A is then either red (at node u) or in state token 
(at node u), and tests configuration cj)i in view of Algorithm Byz-Unknown-Size. So still according 
to Algorithm Byz-Unknown-Size, there are at least k red agents that claim testing configuration (pi 
at node v in round t" , while there are at least f + 1 agents (which are red or in state token) that 
claim testing configuration pi at node u in the same round t". Hence there are at least k + 1 good 
agents which test the same configuration pi in round t” and such that each of them is either red or 
in state token. However, this implies that each of these good agents has its label in configuration 
pi (otherwise it would have been impossible for at least one of them to be in substate red of phase 
i or in state token of phase i in round t" according to the rules of state setup): there are then at 
least k + \ distinct labels in pi which contradicts the definition of k. Hence agent B cannot be in 
substate red of phase i in round t" . Let us now consider that agent A is in substate red of phase 
i in round t"\ in this round agent B is then either red (at node v) or in state token (at node v) or 
in state explorer in round t", and tests configuration pi. If agent B tests configuration pi and is 
either red or in state token in round t" , then similarly as above we can get a contradiction with 
the definition of k. If agent B tests configuration pi and is in state explorer in round t" , then it is 
either red or in state token at node v in round t" — T{EST{ni)) — 1, while agent A is necessary 
red at node u in the same round in view of the definition of t” and Algorithm Byz-Unknown-Size. 
Therefore similarly as above we can prove there are at least A: -|- 1 good agents which test the same 
configuration pi in round t” — T{EST{ni)) — 1 and such that each of them is either red or in state 
token leading again to a contradiction with the definition of k. Hence Case 1 is impossible. 

• Case 2: in round t agent A adds a node to its BPS tree T under construction that has to be rejected. 
This can occur only if at some point during the exploration of agent A, there are not at least f + I 
agents at node u that claim being in state token of phase i. Since agent A adds a node x to its BPS 
tree, we know that the execution of procedure EST' by agent A does not terminate in round t as it 
remains to make at least the process of node x. Prom round t on, if agent A does not meet any group 
of at least f + 1 agents that claim being in state token of phase i during the current execution of 
EST' , then at some point it has spent more than T{EST{ni)) rounds executing EST' in phase i and 
transits to state failure of phase i: we get a contradiction with that fact that agent A enters state 
tower of phase i from state explorer of phase i. So there is a round after round t, during its 
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execution of EST' in phase i, where agent A meets a group of at least / + 1 agents that claim being 
in state token of phase i. This group is located either on a node different from node u or on node 
u (in which case a ’’new token” appears on node u after the disappearance of the first one): by using 
similar arguments to those used above, we can also get a contradiction with the definition of k in both 
these situations. 

So, rii cannot be different from n, and thus the claim follows. 

Now we can conclude the proof for the case where agent A enters state tower from state explorer 
in round r. Indeed, according to Claim 1, the BPS tree T computed by agent A before transiting to state 
token in round r is of size n. However, according to Algorithm Byz-Unknown-Size agent A can transit 
from state explorer of phase i to state token of phase i only if the size of T is equal to n*. Hence we 
necessarily have re = n* in this case. 

To end the proof of this lemma, it remains to consider the case where agent A enters state tower from state 
token in round r. According to Algorithm Byz-Unknown-Size, agent A can make such a transition only if 
it previously transited from state explorer of phase i to state token of phase i. Hence, still according to 
Algorithm Byz-Unknown-Size, agent A computed a BPS tree D having size re*, while in state explorer 
of phase i. However in view of the claim below, the size of D is necessarily equal to re. Hence re = re*, 
which proves the lemma also holds in the case where agent A enters state tower from state token in 
round r. 

Claim 2. The size of D is re. 

If rii = n then the claim is true because agent A can transit from state explorer to state token in round 
r only if m = re*. Concerning the case where re* ^ re, similarly to what is done for this case in the proof of 
Claim 1, we can get the same contradictions, which proves the claim. 

□ 


Lemma 4.6 In any round there is at most one tower. 

Proof. Assume by contradiction there exists some round r when there are two distinct towers Vj and Tk- 
The members of Vj (resp. Tk) are in state tower and all have index j (resp. index k). Note that in the case 
where Vj and Tk are at the same node, indexes j and k are different from each other, otherwise we would 
have Vj = Tk according to the definition of a tower. In the other case, index j is not necessarily different to 
index k. 

By Lemma l4!2l there is a good agent A G Vj (resp. B G Tk) which has been in state tower since round 
r — j (resp. round r — k). Since agent A (resp. agent B) is in state tower with index j (resp. index k) in 
round r, agent A (resp. agent B) enters state tower in round r—j (resp. round r—k) from state explorer 
or token. Let (t>i be the configuration tested by agent A in round r. In round r—j, agent A enters state 
tower of phase i from state explorer of phase i or state token of phase i. So, by Lemma 1431 we have 
Ui = re, and then we know that i > a. Hence according to Lemma 14.31 agent B also tests configuration 
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in round r, and according to Algorithm Byz-Unknown-Size it enters state tower of phase i from state 
explorer or token of phase i in round r — k. Let t be the last round before round r such that agent 
A or i? is red in phase i. Without loss of generality, assume that in round t agent A is red and tests 
configuration cj)i. According to Algorithm Byz-Unknown-Size agent A enters state explorer or token 
of phase i from state tower builder in round f -|- 1 at some node u. By Lemmas [4.3l and l4!4l in round 
f -t 1 agent B is either in state wait-f or-a-tower of phase i or also enters state explorer or token 
of phase i from state tower builder at node u. Let us first consider the first case in which agent B is 
in state wait-f or-a-tower of phase i in round f -|- 1. In this case, we cannot have r — k<t + lasit 
is impossible to transit directly or indirectly from state tower of phase i to state wait-f or-a-tower 
of phase i. So, we necessarily have r — k > t + 1. However this implies that agent B cannot enter state 
tower of phase i from state explorer or token of phase i in round r — k because it is impossible to 
reach (directly or indirectly) state explorer or token of phase i from state wait-f or-a-tower of 
phase i. The first case is therefore impossible. Concerning the second case, it implies that agents A and B 
computed the same set H in round t at the same node u (i.e., during the last round of their waiting period as 
red agents of phase i). Hence according to Algorithm Byz-Unknown-Size agents A and B enter together 
state tower of phase i in round t + 2\H\T{EST{n)) + l = r — j = r — k, and thus belong to the same 
tower in round r, which is a contradiction. □ 


Lemma 4.7 If a good agent declares gathering is over at node v in round r, then all good agents are at 
node V in round r and declare that gathering is over in round r. 

Proof. Assume by contradiction there is a good agent A that declares gathering is over at node v in round r 
but there is a good agent B that does not make such a declaration at the same node and in the same round. 
Without loss of generality, we assume round r is the first round when an agent declares gathering is over. 
Thus, agent B does not declare gathering is over before round r. Let fi be the configuration tested by agent 
A in round r. Let k be the number of labels in configuration fi. 

According to Algorithm Byz-Known-Size, there is a tower Tp^m) iri round r at node v: all agents belonging 
to Tpi^m) ^0 in state tower and have index P{ni) (which corresponds to the number of edge traversal of 
procedure EXPLO{ni)). By Lemma l4~2l there is a good agent C inside of tower Tp^m) which has been in 
state tower since round r — P{ni). Thus agent C is in state tower and has index 0 in round r — P{ni). 
This implies that agent C enters state tower from state explorer or token in round r — P{ni). 

Let (j)j be the configuration tested by agent C in round r — P{ni). By Lemma l431 we have rij = re, and thus 
j > a. Moreover according to Algorithm Byz-Unknown-Size, agent C still tests configuration fj in round 
r. Since agent A tests configuration fi in round r and j > a, by Lemma 1431 we know i = j. Hence all 
good agents in Tp^m) iri round r test configuration fi, which implies all good agents of Tp^m) declare that 
gathering is over in round r according to Algorithm Byz-Unknown-Size. Agent B also tests configuration 
(pi in round r but it is not in state tower of phase i, as otherwise it would belong to Tp^m) by Lemma |4~6] 
and thus it would also declare that gathering is over in round r, which contradicts the definition of agent B. 

As mentioned above we have j > (x, i = j and n = rij. Hence i > a and re* = re. 

According to Lemmas 14.31 and l4Al when agent C enters state explorer of phase i or state token of 
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phase i from state tower builder of phase i in round r — P{n) — 2\H\* T{EST{n)) at some node u 
(for the definition of H, refer to the description of substate red in Algorithm Byz-Unknown-Size), then in 
the same round agent B either also enters state explorer of phase i or state token of phase i from state 
tower builder of phase i at node u, or is in state wait-f or-a-tower of phase i. 

Let us first consider the first situation. In this situation, agent B determined the same set H as agent C in the 
last round as a red agent in phase i. According to Algorithm Byz-Unknown-Size, agent B also enters state 
tower of phase i at the same node and in the same round as agent C, or agent B enters state failure of 
phase i by round r — P{n). In the former case, agent B and C then belong to tower Tp^m) round r and 
agent B declares that gathering is over in round r, which is a contradiction. The latter case in which agent 
B is in state failure of phase i by round r — P{n) requires a deeper analysis. According to Algorithm 
Byz-Unknown-Size, for each round of {r — P{n) — 2\H\ * T{EST{n)), ■ ■ ■ ,r — P{n) — 1} agent C is 
either in state token of phase i or in state explorer of phase i. If agent B and C are in state token 
of phase i when agent B decides to transit to state failure of phase i, then agent C does the same thing 
according to Algorithm Byz-Unknown-Size and we get a contradiction with the fact that agent C declares 
gathering is over in round r as an agent in state token of phase i (as it is impossible to reach state tower 
of phase i once in state failure of phase i). If agent B is explorer while agent C is token when agent 
B decides to transit to state failure then that implies agent B computes a BPS tree of a size smaller 
than rii = n. (Indeed agent B can compute a BPS tree of a size larger than n* only if at some point its 
token disappears, but that implies that agent C enters state failure of phase i and as above we get a 
contradiction with the definition of C. Por the same reasons, agent B cannot spent more than T{EST{ni)) 
rounds to compute the BPS tree or decide to transit to state failure after having backtracked to its token 
i.e., after having traversed all edges traversed during the execution of procedure EST' in the reverse order 
and the reverse direction). The only reason is that at some point agent B rejects a node x that has to be 
added to its BPS tree under construction: similarly as in the proof of Claim 1 in the proof of Lemma 1431 
we can get a contradiction with the definition of k. If agents A and B are in state explorer of phase i in 
the same round we get a contradiction with the fact that they computed the same set H before leaving state 
tower builder of phase i. It remains to analyse the case in which agent B is token while agent C is 
explorer when agent B decides to transit to state failure of phase i in some round t < r — P{ni). 
According to Algorithm Byz-Unknown-Size the token of agent C disappears in round t. Moreover similarly 
as in the proof of Claim 1 in the proof of Lemma 14.51 we can argue that from round t on, agent C cannot 
meet a group of at least / -|- 1 agents that claim being in state token of phase i. Hence when agent C 
verifies in round r — P{ni) — 1 if it is with a group of at least / -|- 1 agents that claim being in state token 
of phase i (just before entering state tower in round r — P{ni)), the condition cannot be fulfilled and thus 
agent C cannot enter state tower in round r — P{ni), which is a contradiction. Since we get a contradiction 
in all cases, the first situation cannot occur. 

Let us now consider the second situation in which agent B is in state walt-f or-a-tower of phase i in 
round r — P{n) — 2\P[\ * T{EST{n)), while C enters state explorer of phase i or state token of phase 
i from state tower builder of phase i in the same round. By using similar arguments to those used in 
the latter two paragraphs of the proof of Lemma [T6l we can distinguish the case in which agent B enters 
state failure of phase i in some round of {r — P{n) — 2\H\ * T{EST{n)) -|- 1, • • • , r} from the case in 
which it does not, and argue that we obtain a contradiction in both cases. Hence agent B does not exist and 
the lemma holds. 
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□ 


Lemma 4.8 There is at least one good agent that ends up declaring that gathering is over. 

Proof. Assume by contradiction no agent ends up declaring gathering is over. Let 4>i £ Tl a. good configu¬ 
ration which corresponds to the initial configuration of all good agents in the graph. We then have rij = n. 
Let k be the number of labels in configuration by definition k > f + 2. Since configuration (pi is good 
and i > a, in view of Proposition 14.21 and Lemma l4ri] and the fact that at least one good agent is woken up 
by the adversary, every good agent reaches state tower builder of phase i possibly in different rounds 
but at the same node v corresponding to the node where the agent having the smallest label is initially lo¬ 
cated. Similarly as in proof of Lemma l3.7l we can prove the following claim (by adjusting the waiting period 
accordingly and by using Propositions 14.11 and 14.21 as well as Lemmas 14.11 and 14.31 instead of respectively 
Propositions 13.21 and 13.11 as well as Lemmas 13.11 and 13.31) . Round r is the first round when a good agent 
becomes yellow in phase i. 

Claim 1. All good agents are yellow at node v and test configuration (pi in round r + T{EXPLO{n)) + 
n + Qi - 1. 

From Claim 1 and Algorithm Byz-Unknown-Size, the k good agents become red together before round 
r + 2T{EXPLO{n)) -|- 2n -|- 2Qi and decide in the same round to leave state tower builder (to enter 
state tower or explorer) after having waited exactly T{EXPLO{n)) + n-\- T{EST{n)) + Qi rounds 
as red agents of phase i. During the last round of this waiting period, all good agents compute the same set 
H which includes each of their labels (and possibly at most / forged labels of Byzantine agents). Note that 
H cannot be larger than n = riias, otherwise that would imply that there are more agents than nodes in the 
graph. Hence H < n and each of the k good agents enters state explorer or token in the same round, 
call it s, at node v. Since set P[ is the same for all good agents and no two of them have the same labels, in 
round s there is exactly at most one good agent Ai that enters state explorer of phase i, while the other 
good agents enter state token of phase i. In fact if the smallest label in H corresponds to a label of a good 
agent there is exactly one good agent Ai that enters state explorer of phase i, otherwise Ai does not exist 
and all the good agents enters state token of phase i. According to the rules of state token, in each round 
of {s, s -|- 1, • • • , s -|- 2T{EST{n)) — 1} there are at least f + l agents in state token of phase i at node v 
as there are at least A: — 1 > / -|- 1 good agents in state token of phase i. As a result, during the execution 
of procedure EST' by agent Ai as an explorer (if it exists), its “token never disappears” and it cannot 
see another token (i.e., a group of at least / -|- 1 agents in state token of phase i) at a node u ^ v because 
there are at most / Byzantine agents and all the good agents different from explorer Ai are at node v. Hence 
agent Ai computes a BFS tree of size n within T{EST{n)) rounds, and then enters state token in round 
s + 2T{EST{n)) after having backtracked to node v. Regardless of whether there was a good agent Ai or 
not, in view of H and the rules of states explorer and token, there is at most one good agent A 2 (which 
had not entered state explorer of phase i yet) that enters state explorer of phase i from state token in 
round s + 2T{EST{n)). More precisely, if the second smallest label in P[ corresponds to a label of a good 
agent there is exactly one good agent A 2 that enters state explorer of phase i in round s + 2T{EST{n)), 
otherwise A 2 does not exist and all good agents are in state token of phase i in round s -|- 2T{EST{n)). 
Moreover, in each round of {s -|- 2T{EST{n)), s + 2T{EST{n)) +1, • • • , s + 4T{EST{n)) — 1} there are 
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at least / + 1 agents in state token of phase i at node v as there are at least A: — 1 > / + 1 good agents in 
state token of phase i (recall that if there was a good agent Ai, it is now in state token). Thus, similarly 
as before, we know that if agent A 2 exists, it computes a BPS tree of size n within T{EST{n)) rounds, and 
is at node v with the other good agents in state token in round s + 4T{EST{n)) — 1 at the latest. From 
this point, regardless of whether there was a good agent A 2 or not, if H = 2 (by definition H >2) then all 
the good agents enters state tower of phase i (including A 2 if any) in round s + AT{EST{n)) according 
to Algorithm Byz-Unknown-Size. Otherwise, in view of H and the rules of states explorer and token, 
there is at most one good agent A 3 (which had not entered state explorer of phase i yet) that enters state 
explorer of phase i from state token in round s + 4T{EST{n)), while agent A 2 (if any) enters the 
state in which the other good agents are i.e., state token of phase i. Again via similar arguments, we know 
that if H = 3 then all the good agents enters state tower (including A 3 if any) in round s + 6T{EST{n)) 
according to Algorithm Byz-Unknown-Size. Otherwise, by induction on the number of labels in H we can 
prove that all good agents enter state tower at node v in round s + 2\H\T{EST{n)). Hence, we know the 
k good agents will make together an entire execution of procedure EXPLO{n): according to the rules of 
state tower, agent A declares gathering is over at the end of this execution. So, we get a contradiction, and 
the lemma holds. □ 

From Lemmas [4.71 and |4^ we know that Algorithm Byz-Unknown-Size and Theorem 14. 3 1 are valid. 

5 Conclusion 

We provided a deterministic /-Byzantine gathering algorithm for arbitrary connected graphs of known size 
(resp. unknown size) provided that the number of good agents is at least f + I (resp. / -|- 2). By providing 
these algorithms, we closed the open question of what minimum number of good agents A4 is required to 
solve the problem, as each of our algorithms perfectly matches the corresponding lower bound on A4 stated 
in m, which is of / -|- 1 when the size of the network is known and of / -|- 2 when it is unknown. Our 
work also highlighted the fact that the ability for the Byzantine agents to change their labels has no impact 
in terms of feasibility when the size of the network is initially unknown, since it was proven in iflAl that A4 
is also equal to / -|- 2 when the Byzantine agents do not have this ability. 

While we gave algorithms that are optimal in terms of required number of good agents, we did not try 
to optimize their time complexity. Actually, the time complexity of both our solutions depends on the 
enumerations of the initial configurations, which clearly makes them exponential in n and the labels of the 
good agents in the worst case. Hence, the question of whether there is a way to obtain algorithms that are 
polynomial in n and in the labels of the good agents (with the same bounds on A4) remains an open problem. 
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